From e4d86f0f9e91c92cd57ae2ef5471b23bdc269f41 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 29 Jul 2026 21:39:59 +0000 Subject: [PATCH] Add narrow audit log actor loaders for CSV export Replace full Identity and PersonalAPIKey batch loads with rows that select only id, email, name fields used in export. Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- pkg/coredata/identity.go | 30 ++++++++++++++++------------ pkg/coredata/personal_api_key.go | 29 +++++++++++++++------------ pkg/iam/log_export_csv.go | 34 ++++++++++++++------------------ 3 files changed, 48 insertions(+), 45 deletions(-) diff --git a/pkg/coredata/identity.go b/pkg/coredata/identity.go index 97345814c..beb015431 100644 --- a/pkg/coredata/identity.go +++ b/pkg/coredata/identity.go @@ -388,7 +388,17 @@ WHERE return count, nil } -func (i *Identities) LoadByIDs( +type ( + IdentityAuditLogActorRow struct { + ID gid.GID `db:"id"` + EmailAddress mail.Addr `db:"email_address"` + FullName string `db:"full_name"` + } + + IdentityAuditLogActorRows []*IdentityAuditLogActorRow +) + +func (rows *IdentityAuditLogActorRows) LoadByIDs( ctx context.Context, conn pg.Querier, identityIDs []gid.GID, @@ -397,13 +407,7 @@ func (i *Identities) LoadByIDs( SELECT id, email_address, - full_name, - hashed_password, - email_address_verified, - saml_subject, - locale, - created_at, - updated_at + full_name FROM identities WHERE @@ -412,17 +416,17 @@ WHERE args := pgx.StrictNamedArgs{"identity_ids": identityIDs} - rows, err := conn.Query(ctx, q, args) + rowsResult, err := conn.Query(ctx, q, args) if err != nil { - return fmt.Errorf("cannot query identities: %w", err) + return fmt.Errorf("cannot query identity audit log actors: %w", err) } - identities, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Identity]) + actors, err := pgx.CollectRows(rowsResult, pgx.RowToAddrOfStructByName[IdentityAuditLogActorRow]) if err != nil { - return fmt.Errorf("cannot collect identities: %w", err) + return fmt.Errorf("cannot collect identity audit log actors: %w", err) } - *i = identities + *rows = actors return nil } diff --git a/pkg/coredata/personal_api_key.go b/pkg/coredata/personal_api_key.go index 6b863b385..38e9475ae 100644 --- a/pkg/coredata/personal_api_key.go +++ b/pkg/coredata/personal_api_key.go @@ -302,7 +302,16 @@ WHERE return nil } -func (a *PersonalAPIKeys) LoadByIDs( +type ( + PersonalAPIKeyAuditLogActorRow struct { + ID gid.GID `db:"id"` + Name string `db:"name"` + } + + PersonalAPIKeyAuditLogActorRows []*PersonalAPIKeyAuditLogActorRow +) + +func (rows *PersonalAPIKeyAuditLogActorRows) LoadByIDs( ctx context.Context, conn pg.Querier, apiKeyIDs []gid.GID, @@ -310,13 +319,7 @@ func (a *PersonalAPIKeys) LoadByIDs( q := ` SELECT id, - identity_id, - name, - expires_at, - expire_reason, - last_used_at, - created_at, - updated_at + name FROM iam_personal_api_keys WHERE @@ -325,17 +328,17 @@ WHERE args := pgx.StrictNamedArgs{"api_key_ids": apiKeyIDs} - rows, err := conn.Query(ctx, q, args) + rowsResult, err := conn.Query(ctx, q, args) if err != nil { - return fmt.Errorf("cannot query personal api keys: %w", err) + return fmt.Errorf("cannot query personal api key audit log actors: %w", err) } - apiKeys, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[PersonalAPIKey]) + actors, err := pgx.CollectRows(rowsResult, pgx.RowToAddrOfStructByName[PersonalAPIKeyAuditLogActorRow]) if err != nil { - return fmt.Errorf("cannot collect personal api keys: %w", err) + return fmt.Errorf("cannot collect personal api key audit log actors: %w", err) } - *a = apiKeys + *rows = actors return nil } diff --git a/pkg/iam/log_export_csv.go b/pkg/iam/log_export_csv.go index cc88cdc11..60c4c91ba 100644 --- a/pkg/iam/log_export_csv.go +++ b/pkg/iam/log_export_csv.go @@ -270,30 +270,26 @@ func loadAuditLogActorExportInfo( result := make(map[gid.GID]auditLogActorExportInfo) - if len(identityIDs) > 0 { - var identities coredata.Identities - if err := identities.LoadByIDs(ctx, conn, identityIDs); err != nil { - return nil, fmt.Errorf("cannot load audit log actor identities: %w", err) - } + var identities coredata.IdentityAuditLogActorRows + if err := identities.LoadByIDs(ctx, conn, identityIDs); err != nil { + return nil, fmt.Errorf("cannot load audit log actor identities: %w", err) + } - for _, identity := range identities { - result[identity.ID] = auditLogActorExportInfo{ - email: identity.EmailAddress.String(), - name: identity.FullName, - } + for _, identity := range identities { + result[identity.ID] = auditLogActorExportInfo{ + email: identity.EmailAddress.String(), + name: identity.FullName, } } - if len(apiKeyIDs) > 0 { - var apiKeys coredata.PersonalAPIKeys - if err := apiKeys.LoadByIDs(ctx, conn, apiKeyIDs); err != nil { - return nil, fmt.Errorf("cannot load audit log actor API keys: %w", err) - } + var apiKeys coredata.PersonalAPIKeyAuditLogActorRows + if err := apiKeys.LoadByIDs(ctx, conn, apiKeyIDs); err != nil { + return nil, fmt.Errorf("cannot load audit log actor API keys: %w", err) + } - for _, apiKey := range apiKeys { - result[apiKey.ID] = auditLogActorExportInfo{ - name: apiKey.Name, - } + for _, apiKey := range apiKeys { + result[apiKey.ID] = auditLogActorExportInfo{ + name: apiKey.Name, } }